On 03/09/2011 09:54 AM, John Edens wrote:
------------
Using * should be fine unless you have multiple IP addresses and want the *server* to *listen* on only some of those addresses - say localhost if you were running web and db on the same machine and didn't want to listen to connections from the outside. This setting only determines where the server listens.
-------------
Okay, done that - what is the difference between listening on only some of those addresses and allowing only clients in a certain range to connect?
They are completely different.
Your server can have multiple IP addresses. In fact, it almost certainly has an IP assigned to your NIC and a localhost address. But you could have multiple NICs in the machine and/or multiple IP addresses assigned to each NIC. This is very common - especially for web servers hosting several sites on different addresses. The addresses can be on different networks, as well.
Suppose your server has addresses 10.1.1.2, 10.1.1.3 and 192.168.1.4. If listen_addresses is set to *, a client could connect to PostgreSQL by connecting to any of those addresses - i.e. the host in their connection string could be any of the addresses you listen on. If that is not what you want, you need to explicitly list the addresses you want PostgreSQL to use.
Now that you are listening on one or more addresses, the pg_hba.conf determines who is allowed to connect. It is completely independent of where you listen. It could include all IP addresses, or one or more individual IPs or IP ranges. And the IP addresses allowed for clients do not need to overlap your listen_address or be on the same IP network.
By way of example, you could have three independent instances of PostgreSQL running on your machine - perhaps one for dev, one for QA and one for deployment-staging. You could have dev listen only on .2, QA on .3 and deploy on .4. You could even have a 4th, say "sandbox", listening on all (though it would have to have a different port). And each one of those instances could have different pg_hba.conf settings to restrict client access as appropriate.
Cheers,
Steve
